Regular expression pattern matching circuit based on a pipeline architecture

ABSTRACT

A regular expression pattern matching circuit based on a pipeline architecture is proposed, which is designed for integration to a data processing system, such as a computer platform, a firewall, or a network intrusion detention system (NIDS), for checking whether an input code sequence (such as a network data packet) is matched to specific patterns predefined by regular expressions. The proposed circuit architecture includes an incremental improvement on an old combination of a comparator circuit module and an NDFA (non-deterministic finite-state automata) circuit module, where the incremental improvement comprises a data signal delay circuit module installed to the comparator circuit module and an enable signal delay circuit module installed to the NDFA circuit module to thereby constitute a multi-sage pipeline architecture that allows a faster processing speed than the prior art.

BACKGROUND OF THE INVENTION

1. Field of the Invention

This invention relates to logic circuit technology, and moreparticularly, to a regular expression pattern matching circuit based ona pipeline architecture which is designed for integration to a dataprocessing system, such as a computer platform, a firewall, or a networkintrusion detection system (NIDS), for checking whether an input codesequence (such as a network data packet) is matched to specific patternspredefined by regular expressions.

2. Description of Related Art

In the application of computer network systems, how to prevent theintrusion of hackers or malicious virus programs is an importantresearch effort in the information industry. Presently, firewalls andNIDS (network intrusion detention system) are the most widely utilizedtechnologies for this purpose. In operation, all incoming and outgoingnetwork data packet are scanned to check whether their patterns arematched to the patterns of known packets from hackers or malicious virusprograms. If a match is found, then the network data packet is blockedor discarded from entering into the network system.

Present network systems typically utilize regular expressions fordescription of the packet data patterns of known hackers or maliciousvirus programs. Presently, one practical implementation for regularexpression pattern matching is to use a logic circuit composed of acomparator circuit module and a non-deterministic finite-state automata(NDFA) circuit module, which is described in more details in thefollowing with reference to FIG. 1 through FIGS. 3A-3B.

FIG. 1 shows the circuit architecture of a conventional regularexpression pattern matching circuit 10 (hereinafter referred to as“prior art”). As shown, this prior art comprises: (A) a comparatorcircuit module 100; and (B) a non-deterministic finite-state automata(NDFA) circuit module 200.

The conventional regular expression pattern matching circuit 10 has aninput interface and an output interface, wherein the input interfaceincludes a data input port DATA_IN, an enable signal input port ENABLE,and a clock signal input port CLK; while the output interface includesan array of N output ports [OUT(1), OUT(2), . . . , OUT(N)]. In thisexample, the data input port DATA_IN is an 8-bit bus for sequentiallytransferring a series of 8-bit characters of an input code sequence; theenable signal input port ENABLE is used for reception of an enablesignal for enabling the operation of the conventional regular expressionpattern matching circuit 10; and the clock signal input port CLK is usedfor reception of a clock signal. The N output ports [OUT(1), OUT(2), . .. , OUT(N)] are each a 1-bit data line whose output signal is used forindicating which regular expression is matched to the input codesequence, i.e., if the (k)th regular expression is a match, then the(k)th output port OUT(k) will output a logic-HIGH signal (1) while allthe other output ports remain at logic-LOW state (0).

As shown in FIG. 2, in one application example of the conventionalregular expression pattern matching circuit 10, the comparator circuitmodule 100 includes a static processing unit 101 and a dynamicprocessing unit 102; wherein the static processing unit 101 has anoutput interface including P output ports: CODE(1), CODE(2), . . . ,CODE(P), whose output values are used for indicating the meaning, role,or function of each character in the input code sequence; while thedynamic processing unit 102 includes Q output ports: CLASS(1), CLASS(2),. . . , CLASS(Q), whose output values are used for indicating the classof each character in the input code sequence. In one practicalapplication, for example, P=290 and the 290 output signals are usedrespectively for indicating 256 ASCII characters, a set of predefinedcharacter ranges, a set of special symbols, a set of special characters(such as blank, non-blank, single word, non-single word, integer, andnon-integer), and 26 case-insensitive English alphabetic letters; whilethe Q output ports are used for indicating predefined classes such as[\x90-\xFF] and [^\s].

FIG. 3A shows the internal circuit architecture of the above-mentionedstatic processing unit 101, which is composed of 4 layers of logiccircuits, including a first-layer logic circuit 110 a, a second-layerlogic circuit 120 a, a third-layer logic circuit 130 a, and afourth-layer logic circuit 140 a. The first-layer logic circuit 110 a isan array of digital comparators, including equal comparators (=),unequal compactors (≠), larger-than compactors (>), and less-thancompactors (<). The second-layer logic circuit 120 a and the third-layerlogic circuit 130 a are a plurality of AND gates and OR gates which arespecifically arranged to operate in combination for checking whether thevalue of a character is within a predefined range. The fourth-layerlogic circuit 140 a is an array of multiplexers (MUX).

Further, FIG. 3B shows the internal circuit architecture of the dynamicprocessing unit 102, which is also composed of 4 layers of logiccircuits, including a first-layer logic circuit 110 b, a second-layerlogic circuit 120 b, a third-layer logic circuit 130 b, and afourth-layer logic circuit 140 b. The first-layer logic circuit 110 b isan array of digital comparators, including equal comparators (=),unequal compactors (≠), larger-than compactors (>), and less-thancompactors (<). The second-layer logic circuit 120 b and the third-layerlogic circuit 130 b are a plurality of AND gates and OR gates. Thefourth-layer logic circuit 140 b is an array of multiplexers (MUX).

One drawback to the circuit architecture of the conventional regularexpression pattern matching circuit 10, however, is that the multi-layerarchitecture (i.e., 4-layer architecture) of the comparator circuitmodule 100 causes a time delay such that after the NDFA circuit module200 is enabled, the NDFA circuit module 200 has to wait until thecomparator circuit module 100 completes its logic operation to startoperation. This time delay undoubtedly cause a degrade in the overallprocessing speed.

SUMMARY OF THE INVENTION

It is therefore an objective of this invention to provide a new andimproved regular expression pattern matching circuit based on a pipelinearchitecture that can offer a faster processing speed than the priorart.

In application, the regular expression pattern matching circuitaccording to the invention is designed for integration to a dataprocessing system, such as a computer platform, a firewall, or a networkintrusion detection system (NIDS), for checking whether an input codesequence (such as a network data packet) is matched to specific patternspredefined by regular expressions.

In architecture, the new and improved regular expression patternmatching circuit according to the invention comprises: (A) a comparatorcircuit module; (B) a regular expression pattern matching module whichis here implemented with a non-deterministic finite-state automata(NDFA) circuit module; (C) a data signal delay circuit module; and (D)an enable signal delay circuit module.

The new and improved regular expression pattern matching circuit of theinvention provides an incremental improvement on the prior art, which isbased on an old combination of a comparator circuit module and a NDFAcircuit module, where the incremental improvement comprises a datasignal delay circuit module installed to the comparator circuit moduleand an enable signal delay circuit module installed to the NDFA circuitmodule to thereby constitute a multi-sage pipeline architecture thatallows a faster processing speed than the prior art.

BRIEF DESCRIPTION OF DRAWINGS

The invention can be more fully understood by reading the followingdetailed description of the preferred embodiments, with reference madeto the accompanying drawings, wherein:

FIG. 1 (PRIOR ART) is a schematic diagram showing the circuitarchitecture of a conventional regular expression pattern matchingcircuit;

FIG. 2 (PRIOR ART) is a schematic diagram showing the internalarchitecture of a comparator circuit module utilized by the prior artshown in FIG. 1;

FIG. 3A (PRIOR ART) is a schematic diagram showing the internalarchitecture of a static processing unit utilized by the comparatorcircuit module shown in FIG. 2;

FIG. 3B (PRIOR ART) is a schematic diagram showing the internalarchitecture of a dynamic processing unit utilized by the comparatorcircuit module shown in FIG. 2;

FIG. 4 is a schematic diagram showing an example of the application ofthe new and improved regular expression pattern matching circuit of theinvention;

FIG. 5 is a schematic diagram showing the I/O functional model of thenew and improved regular expression pattern matching circuit of theinvention;

FIG. 6 is table depicting a regular expression database for use with theinvention;

FIG. 7 is a schematic diagram showing the architecture of a firstpreferred embodiment of the new and improved regular expression patternmatching circuit of the invention;

FIG. 8A is a schematic diagram showing the installation of the datasignal delay circuit module in the static processing unit in accordancewith the first preferred embodiment of the invention;

FIG. 8B is a schematic diagram showing the installation of the datasignal delay circuit module in the dynamic processing unit in accordancewith the first preferred embodiment of the invention;

FIG. 9 is a schematic diagram showing the architecture of a secondpreferred embodiment of the regular expression pattern matching circuitof the invention;

FIG. 10 is a schematic diagram showing the architecture of a thirdpreferred embodiment of the regular expression pattern matching circuitof the invention; and

FIG. 11 is a schematic diagram showing an example of the internalarchitecture of the NDFA circuit module utilized by the invention.

DETAILED DESCRIPTION OF PREFERRED EMBODIMENTS

The new and improved regular expression pattern matching circuit basedon a pipeline architecture according to the invention is disclosed infull details by way of preferred embodiments in the following withreference to the accompanying drawings FIG. 4 through FIG. 11.

Application and Function of the Invention

FIG. 4 shows the application of the new and improved regular expressionpattern matching circuit of the invention (which is here encapsulated ina box labeled with the reference numeral 30). As shown, in thisapplication example, the regular expression pattern matching circuit ofthe invention 30 is used for integration to a data processing system 20,such as a computer unit, a firewall, or a network intrusion detectionsystem (NIDS), for equipping the data processing system 20 with aregular expression pattern matching function.

FIG. 5 shows the I/O (input/output) functional model of the regularexpression pattern matching circuit of the invention 30. As shown, theinvention is used for processing an input code sequence 41 received bythe data processing system 20 with the purpose of checking whether thepattern of the input code sequence 41 is matched to one or more specificpatterns that are predefined by a set of N regular expressions specifiedin a regular expression database 21 shown in FIG. 6. The end processingresult is outputted as a result message 42 which shows thematch/mismatch status of the input code sequence 41 and, if the resultis a match, further indicates which regular expression in the regularexpression database 20 is matched to the input code sequence 41.

In practical applications, for example, the input code sequence 41 canbe a text string or a network data packet. For example, in theapplication with a computer platform, the invention can be used forchecking whether an input text string supplied by a user trying to login to the computer platform is a valid and authorized username orpassword. In the application with a firewall or NIDS, the invention canbe used for checking whether an incoming network data packet isoriginated from a hacker or malicious virus program. Moreover, the inputcode sequence 41 can be either an ASCII (American Standard Code forInformation Interchange) or EBCDIC (Extended Binary Coded DecimalInterchange Code) compliant code sequence.

Architecture of the Invention

Fundamentally, the invention provides an incremental improvement on theprior art shown in FIG. 1 through FIGS. 3A-3B by adding a pipelinearchitecture to the prior art. In accordance with the invention, 3different preferred embodiments are disclosed in the following, whereinthe first preferred embodiment is the best mode embodiment.

First Preferred Embodiment

Referring to FIG. 7, the first preferred embodiment of the regularexpression pattern matching circuit of the invention 30 comprises: (A) acomparator circuit module 100; (B) a regular expression pattern matchingmodule which is here implemented with a non-deterministic finite-stateautomata (NDFA) circuit module 200; (C) a data signal delay circuitmodule 310; and (D) an enable signal delay circuit module 320 (note thatcomponents that are the same as the prior art are labeled with the samereference numerals). Firstly, the respective attributes and functions ofthese constituent components of the invention are described in detailsin the following.

As shown in FIG. 7, the comparator circuit module 100 is based on amulti-layer circuit architecture including a number of layers of logiccircuits, such as 4 layers including a first-layer logic circuit 110, asecond-layer logic circuit 120, a third-layer logic circuit 130, and afourth-layer logic circuit 140. In the circuit representation of FIG. 7,the first-layer logic circuit 110 represents a combined assembly of thetwo first-layer logic circuits (110 a, 110 b) of the static processingunit 101 and the dynamic processing unit 102 shown in FIGS. 3A-3B; thesecond-layer logic circuit 120 represents a combined assembly of the twosecond-layer logic circuits (120 a, 120 b); the third-layer logiccircuit 130 represents a combined assembly of the two third-layer logiccircuits (130 a, 130 b); and the fourth-layer logic circuit 140represents a combined assembly of the two fourth-layer logic circuits(140 a, 140 b). In actual implementation, for example, the comparatorcircuit module 100 can be realized by using an FPGA (Field ProgrammableGate Array) module.

The NDFA circuit module 200 is composed of N state transition basedpattern matching units which are respectively used for pattern matchingof the N regular expressions defined in the regular expression database21 shown in FIG. 6. For example, as depicted in FIG. 11, assume that the(k)th pattern matching unit is set to the pattern [abc], then itsinternal logic circuit architecture includes 3 state transition unitSTATE(a), STATE(b), and STATE(c) as illustrated in FIG. 11. Inoperation, when the first state transition unit STATE(a) receives thedata “a”, then its output port will generate a logic-HIGH signal forenabling the second state transition unit STATE(b); and subsequently ifthe enabled second state transition unit STATE(b) receives the data “b”in the next cycle, then it will generate an output of a logic-HIGHsignal for enabling the third state transition unit STATE(c); andfinally if the enabled third state transition unit STATE(c) receives thedata “c” in the next cycle, then it will generate an output of alogic-HIGH signal which can be used for indicating that the processingresult is a match. On the contrary, if the output of the third statetransition unit STATE(c) is a logic-LOW signal, then it indicates thatthe processing result is a mismatch. Since the NDFA is well known andwidely utilized technology in the information industry, details thereofwill not be further described in this specification.

As shown in FIG. 7, in the first preferred embodiment, the data signaldelay circuit module 310 includes 4 stages of buffer arrays: afirst-stage buffer array 311, a second-stage buffer array 312, athird-stage buffer array 313, and a fourth-stage buffer array 314. These4 buffer arrays (311, 312, 313, 314) are respectively coupled to theoutput ends of the first-layer logic circuit 110, the second-layer logiccircuit 120, the third-layer logic circuit 130, and the fourth-layerlogic circuit 140; and each of which is used for providing a one-cycledelayed buffer function to the output data at the respective outputports of these 4 layers of logic circuits (110, 120, 130, 140).

FIG. 8A shows the architecture of the installation of one part of the 4buffer arrays (311, 312, 313, 314) to the static processing unit 101 inthe comparator circuit module 100; while FIG. 8B shows the architectureof the installation of the other part of the 4 buffer arrays (311, 312,313, 314) to the dynamic processing unit 102.

Referring back to FIG. 7, the enable signal delay circuit module 320 iscoupled between the enable signal input port ENABLE and the input portof the NDFA circuit module 200, and which is composed of 4serially-connected buffer units: including a first-stage buffer unit321, a second-stage buffer unit 322, a third-stage buffer unit 323, anda fourth-stage buffer unit 324. In practice, for example, these bufferunits (321, 322, 323, 324) can be each implemented with a flip flop(FF).

The installation of the buffer arrays (311, 312, 313, 314) and thebuffer units (321, 322, 323, 324) constitutes a 5-stage pipelinearchitecture, wherein the first stage STAGE_1 is constituted by thefirst-layer logic circuit 110 and the first-stage buffer array 311; thesecond stage STAGE_2 is constituted by the second-layer logic circuit120 and the second-stage buffer array 312; the third stage STAGE_3 isconstituted by the third-layer logic circuit 130 and the third-stagebuffer array 313; the fourth stage STAGE_4 is constituted by thefourth-layer logic circuit 140 and the fourth-stage buffer array 314;and the fifth stage STAGE_5 is constituted solely by the NDFA circuitmodule 200.

In operation, the logic operations from STAGE_1 to STAGE_5 can beclocked by using 5 consecutive clock pulses. At the completion of thefirst-stage operation on the first character of the input code sequence41, the first-layer logic circuit 110 can be started to receive andprocess the second character of the input code sequence 41; and at thecompletion of the second-stage operation and start of the third-stageoperation on the first character, the first-layer logic circuit 110 canbe started to receive and process the third character of the input codesequence 41; and further at the completion of the third-stage operationand start of the fourth-stage operation on the first character, thefirst-layer logic circuit 110 can be started to receive and process thefourth character of the input code sequence 41; and so forth. This5-stage pipelined processing can undoubtedly help boost the processingspeed and thus offer a better performance than the prior art.

Second Preferred Embodiment

As shown in FIG. 9, in the second preferred embodiment, the data signaldelay circuit module 310 includes only one single stage of buffer arraywhich is coupled to the output end of the fourth-layer logic circuit 140in the comparator circuit module 100. Correspondingly, the enable signaldelay circuit module 320 also includes only one single buffer unit (FF).

The foregoing circuit arrangement constitutes a 2-stage pipelinearchitecture (STAGE_1, STAGE_2) for processing of the input codesequence 41 through two pipelined stages. The resulted processing speed,however, is inferior to the 5-stage pipeline architecture describedabove.

Third Preferred Embodiment

As shown in FIG. 10, in the third preferred embodiment, the data signaldelay circuit module 310 includes only two stages of buffer arrays: afirst-stage buffer array 311 and a second-stage buffer array 312;wherein the first-stage buffer array 311 is coupled to the output end ofthe first-layer logic circuit 110, while the second-stage buffer array312 is coupled to the output end of the fourth-layer logic circuit 140.Correspondingly, the enable signal delay circuit module 320 includes twoserially-connected single buffer unit (FF), including a first-stagebuffer unit 321 and a second-stage buffer unit 322.

The foregoing circuit arrangement constitutes a 3-stage pipelinearchitecture (STAGE_1, STAGE_2, STAGE_3) for processing of the inputcode sequence 41 through 3 pipelined stages. The resulted processingspeed is inferior to the 5-stage pipeline architecture of the firstpreferred embodiment, but better than the 2-stage pipeline architectureof the second preferred embodiment.

Generalization of the Invention

The above-described 3 preferred embodiments of the invention are basedon the example of a 4-layer circuit architecture of the comparatorcircuit module 100. Broadly speaking, however, the invention is notlimited to the application on a 4-layer circuit architecture, and rathercan be applied for use on an M-layer circuit architecture, where M isany integer number, such as 2, 3, 5, 6, or more.

Further, in the case of the comparator circuit module 100 having Mlayers of logic circuits, the number of the stages of buffer arraysinstalled to the data signal delay circuit module 310 and the numberserially-connected buffer units installed to the enable signal delaycircuit module 320 can be arbitrarily chosen to be an integer in therange from 1 to M. Fundamentally, a larger number of pipeline stageswill result in a better processing speed but a greater degree ofhardware complexity for implementation; whereas a smaller number ofpipeline stages will result in a less degree of hardware complexity buta poor processing speed (which is nevertheless better than the priorart). In practice, a tradeoff between performance and hardwarecomplexity is chosen by selecting a number of pipeline stages between 1and M.

The invention has been described using exemplary preferred embodiments.However, it is to be understood that the scope of the invention is notlimited to the disclosed embodiments. On the contrary, it is intended tocover various modifications and functional equivalent arrangements. Thescope of the claims, therefore, should be accorded the broadestinterpretation so as to encompass all such modifications and functionalequivalent arrangements.

What is claimed is:
 1. A regular expression pattern matching circuit foruse with a data processing system for processing an input code sequenceto check whether the input code sequence is matched to a patternpredefined by a regular expression, which comprises: an input interfacehaving a data input port, an enable signal input port, and a clocksignal input port; a comparator circuit module, which includes multiplelayers of logic circuits and a plurality of output ports, wherein themultiple layers of logic circuits are used to perform predefinedcomparison operations on each character of the input code sequence tothereby determine the meaning of each character in the input codesequence; a data signal delay circuit module, which includes at leastone stage of buffer array coupled to the output of at least one layer ofthe multiple layers of logic circuits in the comparator circuit modulefor providing a pipeline architecture in the comparator circuit module;an enable signal delay circuit module, which includes at least one stageof buffer unit that is at the same stage as the buffer array of the datasignal delay circuit module and coupled to the enable signal input portfor providing a synchronized pipeline architecture with the pipelinearchitecture in the comparator circuit module; and a regular expressionpattern matching module, which is connected to the output of the bufferarray of the data signal delay circuit module and includes an array ofpattern matching units each of which is preset to one regular expressiondefined pattern for comparing whether the output of the comparatorcircuit module is matched to the predefined pattern.
 2. The regularexpression pattern matching circuit of claim 1, wherein the dataprocessing system is a computer platform.
 3. The regular expressionpattern matching circuit of claim 1, wherein the data processing systemis a firewall.
 4. The regular expression pattern matching circuit ofclaim 1, wherein the data processing system is a network intrusiondetection system (NIDS).
 5. The regular expression pattern matchingcircuit of claim 1, wherein the input code sequence is an ASCII(American Standard Code for Information Interchange) compliant codesequence.
 6. The regular expression pattern matching circuit of claim 1,wherein the input code sequence is an EBCDIC (Extended Binary CodedDecimal Interchange Code) compliant code sequence.
 7. The regularexpression pattern matching circuit of claim 1, wherein the comparatorcircuit module is implemented with an FPGA (Field Programmable GateArray) module.
 8. The regular expression pattern matching circuit ofclaim 1, wherein each buffer array in the data signal delay circuitmodule is an array of flip-flops.
 9. The regular expression patternmatching circuit of claim 1, wherein each buffer unit in the enablesignal delay circuit module is a flip-flop.
 10. The regular expressionpattern matching circuit of claim 1, wherein the regular expressionpattern matching module is implemented with a non-deterministicfinite-state automata (NDFA) circuit module.
 11. The regular expressionpattern matching circuit of claim 1, wherein the data signal delaycircuit module and the enable signal delay circuit module are eachequipped with one layer of buffer circuit for constituting a 2-stagepipeline architecture.
 12. The regular expression pattern matchingcircuit of claim 1, wherein the data signal delay circuit module and theenable signal delay circuit module are each equipped with two layers ofbuffer circuits for constituting a 3-stage pipeline architecture. 13.The regular expression pattern matching circuit of claim 1, wherein thedata signal delay circuit module and the enable signal delay circuitmodule are each equipped with a plurality of layers of buffer circuitsfor constituting a multi-stage pipeline architecture.
 14. The regularexpression pattern matching circuit of claim 1, wherein the at least onestage of buffer unit is selected from a plurality of stages of bufferunits.
 15. A regular expression pattern matching circuit for use with adata processing system for processing an input code sequence to checkwhether the input code sequence is matched to a pattern predefined by aregular expression, which comprises: an input interface having a datainput port, an enable signal input port, and a clock signal input port;a comparator circuit module, which includes multiple layers of logiccircuits and a plurality of output ports, wherein the multiple layers oflogic circuits are used to perform predefined comparison operations oneach character of the input code sequence to thereby determine themeaning of each character in the input code sequence; a data signaldelay circuit module, which includes a plurality of buffer arrayscoupled to the output ends of the multiple layers of logic circuits inthe comparator circuit module for providing a pipeline architecture inthe comparator circuit module; an enable signal delay circuit module,which includes a plurality of serially-connected buffer unitscorresponding to the pipeline architecture in the comparator circuitmodule and coupled to the data input port for providing a synchronizedpipeline architecture with the pipeline architecture in the comparatorcircuit module; and a regular expression pattern matching module, whichis connected to the output of the buffer arrays of the data signal delaycircuit module and includes an array of pattern matching units each ofwhich is preset to one regular expression defined pattern for comparingwhether the output of the comparator circuit module is matched to thepredefined pattern.
 16. The regular expression pattern matching circuitof claim 15, wherein the input code sequence is an ASCII (AmericanStandard Code for Information Interchange) compliant code sequence. 17.The regular expression pattern matching circuit of claim 15, wherein theinput code sequence is an EBCDIC (Extended Binary Coded DecimalInterchange Code) compliant code sequence.
 18. The regular expressionpattern matching circuit of claim 15, wherein the comparator circuitmodule is implemented with an FPGA (Field Programmable Gate Array)module.
 19. The regular expression pattern matching circuit of claim 15,wherein each buffer array in the data signal delay circuit module is anarray of flip-flops.
 20. The regular expression pattern matching circuitof claim 15, wherein each buffer unit in the enable signal delay circuitmodule is a flip-flop.